pnpm vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20251
4. 202628

Newest CVEs

• CVE-2026-101044

  pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

  pnpm · pnpm

  High7.1
• CVE-2026-101043

  pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

  pnpm · pnpm

  High8.3
• CVE-2026-82393

  pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

  pnpm · pnpm

  High7.5
• CVE-2026-82392

  pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

  pnpm · pnpm

  High7.1
• CVE-2026-59195

  pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

  pnpm · pnpm

  High8.2
• CVE-2026-59196

  pnpm: hoisted install imports lockfile alias outside node_modules

  pnpm · pnpm

  High7.1
• CVE-2026-59194

  pnpm: patch-remove could delete project-selected files outside the patches directory

  pnpm · pnpm

  High7.1
• CVE-2026-55180

  pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

  pnpm · pnpm

  Medium6.5
• CVE-2026-48995

  pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

  pnpm · pnpm

  Medium4.8
• CVE-2026-50017

  pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

  pnpm · pnpm

  Medium6.9